<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Actions | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'actions.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/actions.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/actions.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/actions.html" rel="nofollow" target="_blank">../en/actions.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="xpack-alerting.html">Alerting on cluster and index events</a></span>
»
<span class="breadcrumb-node">Actions</span>
</div>
<div class="navheader">
<span class="prev">
<a href="condition-script.html">« Script condition</a>
</span>
<span class="next">
<a href="action-foreach.html">Running an action for each element in an array »</a>
</span>
</div>
<div class="chapter xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="actions"></a>Actions<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions.asciidoc">edit</a><a class="xpack_tag" href="https://www.elastic.co/subscriptions"></a>
</h2>
</div></div></div>
<p>When a watch’s condition is met, its actions are executed unless it is being
<a class="xref" href="actions.html#actions-ack-throttle" title="Acknowledgement and throttling">throttled</a>. A watch can perform multiple actions.
The actions are executed one at a time and each action executes independently.
Any failures encountered while executing an action are recorded in the
action result and in the watch history.</p>
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>If no actions are defined for a watch, no actions are executed.
        However, a <code class="literal">watch_record</code> is still written to the watch history.</p>
</div>
</div>
<p>Actions have access to the payload in the execution context. They can use it to
support their execution in any way they need. For example, the payload might
serve as a model for a templated email body.</p>
<p>Watcher supports the following types of actions:
<a class="xref" href="actions-email.html" title="Email action"><code class="literal">email</code></a>, <a class="xref" href="actions-webhook.html" title="Webhook action"><code class="literal">webhook</code></a>, <a class="xref" href="actions-index.html" title="Index action"><code class="literal">index</code></a>,
<a class="xref" href="actions-logging.html" title="Logging Action"><code class="literal">logging</code></a>, <a class="xref" href="actions-slack.html" title="Slack Action"><code class="literal">slack</code></a>,
and <a class="xref" href="actions-pagerduty.html" title="PagerDuty action"><code class="literal">pagerduty</code></a>.</p>
<h3>
<a id="actions-ack-throttle"></a>Acknowledgement and throttling<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/x-pack/docs/en/watcher/actions.asciidoc">edit</a>
</h3>
<p>During the watch execution, once the condition is met, a decision is made per
configured action as to whether it should be throttled. The main purpose of
action throttling is to prevent too many executions of the same action for the
same watch.</p>
<p>For example, suppose you have a watch that detects errors in an application’s log
entries. The watch is triggered every five minutes and searches for errors during
the last hour. In this case, if there are errors, there is a period of time where
the watch is checked and its actions are executed multiple times based on the same
errors. As a result, the system administrator receives multiple notifications about
the same issue, which can be annoying.</p>
<p>To address this issue, Watcher supports time-based throttling. You can define
a throttling period as part of the action configuration to limit how often the
action is executed. When you set a throttling period, Watcher prevents repeated
execution of the action if it has already executed within the throttling period
time frame (<code class="literal">now - throttling period</code>).</p>
<p>The following snippet shows a watch for the scenario described above - associating
a throttle period with the <code class="literal">email_administrator</code> action:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">PUT _watcher/watch/error_logs_alert
{
  "metadata" : {
    "color" : "red"
  },
  "trigger" : {
    "schedule" : {
      "interval" : "5m"
    }
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : "log-events",
        "body" : {
          "size" : 0,
          "query" : { "match" : { "status" : "error" } }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 5 }}
  },
  "actions" : {
    "email_administrator" : {
      "throttle_period": "15m", <a id="CO513-1"></a><i class="conum" data-value="1"></i>
      "email" : { <a id="CO513-2"></a><i class="conum" data-value="2"></i>
        "to" : "sys.admino@host.domain",
        "subject" : "Encountered {{ctx.payload.hits.total}} errors",
        "body" : "Too many error in the system, see attached data",
        "attachments" : {
          "attached_data" : {
            "data" : {
              "format" : "json"
            }
          }
        },
        "priority" : "high"
      }
    }
  }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/1281.console"></div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO513-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>There will be at least 15 minutes between subsequent <code class="literal">email_administrator</code>
action executions.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO513-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>See <a class="xref" href="actions-email.html" title="Email action">Email action</a> for more information.</p>
</td>
</tr>
</table>
</div>
<p>You can also define a throttle period at the watch level. The watch-level
throttle period serves as the default throttle period for all of the actions
defined in the watch:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">PUT _watcher/watch/log_event_watch
{
  "trigger" : {
    "schedule" : { "interval" : "5m" }
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : "log-events",
        "body" : {
          "size" : 0,
          "query" : { "match" : { "status" : "error" } }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 5 }}
  },
  "throttle_period" : "15m", <a id="CO514-1"></a><i class="conum" data-value="1"></i>
  "actions" : {
    "email_administrator" : {
      "email" : {
        "to" : "sys.admino@host.domain",
        "subject" : "Encountered {{ctx.payload.hits.total}} errors",
        "body" : "Too many error in the system, see attached data",
        "attachments" : {
          "attached_data" : {
            "data" : {
              "format" : "json"
            }
          }
        },
        "priority" : "high"
      }
    },
    "notify_pager" : {
      "webhook" : {
        "method" : "POST",
        "host" : "pager.service.domain",
        "port" : 1234,
        "path" : "/{{watch_id}}",
        "body" : "Encountered {{ctx.payload.hits.total}} errors"
      }
    }
  }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/1282.console"></div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO514-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>There will be at least 15 minutes between subsequent action executions
(applies to both <code class="literal">email_administrator</code> and <code class="literal">notify_pager</code> actions)</p>
</td>
</tr>
</table>
</div>
<p>If you do not define a throttle period at the action or watch level, the global
default throttle period is applied. Initially, this is set to 5 seconds. To
change the global default, configure the <code class="literal">xpack.watcher.execution.default_throttle_period</code>
setting in <code class="literal">elasticsearch.yml</code>:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">xpack.watcher.execution.default_throttle_period: 15m</pre>
</div>
<p>Watcher also supports acknowledgement-based throttling. You can acknowledge a
watch using the <a class="xref" href="watcher-api-ack-watch.html" title="Ack watch API">ack watch API</a> to prevent the
watch actions from being executed again while the watch condition remains <code class="literal">true</code>.
This essentially tells Watcher "I received the notification and I’m handling
it, please do not notify me about this error again". An acknowledged watch action
remains in the <code class="literal">acked</code> state until the watch’s condition evaluates to <code class="literal">false</code>.
When that happens, the action’s state changes to <code class="literal">awaits_successful_execution</code>.</p>
<p>To acknowledge an action, you use the <a class="xref" href="watcher-api-ack-watch.html" title="Ack watch API">ack watch API</a>:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">POST _watcher/watch/&lt;id&gt;/_ack/&lt;action_ids&gt;</pre>
</div>
<div class="console_widget" data-snippet="snippets/1283.console"></div>
<p>Where <code class="literal">&lt;id&gt;</code> is the id of the watch and <code class="literal">&lt;action_ids&gt;</code> is a comma-separated list
of the action ids you want to acknowledge. To acknowledge all actions, omit the
<code class="literal">actions</code> parameter.</p>
<p>The following diagram illustrates the throttling decisions made for each action
of a watch during its execution:</p>
<div class="imageblock text-center">
<div class="content">
<img src="../static/images/action-throttling.jpg" alt="action throttling">
</div>
</div>









</div>
<div class="navfooter">
<span class="prev">
<a href="condition-script.html">« Script condition</a>
</span>
<span class="next">
<a href="action-foreach.html">Running an action for each element in an array »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>